Hacker News Reader

Neat. Adding three lines to my sshd_config makes lines go green.

Unfortunately, Dropbear doesn't appear to support any Encrypt-then-MAC algorithms, so I can't get my swarm of OpenWRT routers all green.

View on HN

You can replace Dropbear with OpenSSH on OpenWRT.

After realizing that I'd have to recompile dropbear myself to disable SHA-1, I also thought about that approach.

I'll figure it out. I'm currently planning the update to 23.05, anyway.

If you're using pre-compiled images, OpenWRT has a package manager and repo with OpenSSH in it. I used to do something like this[1] to install and update OpenSSH outside of internal flash, before deciding that exposing SSH on my router was a bad idea in general.

If you're compiling OpenWRT yourself, you can easily just switch them out in your base image, too.

[1] https://openwrt.org/docs/guide-user/additional-software/extr...

If your client puts sensible options first, those are the ones that will get used. So most likely you're using chachapoly and x25519 always anyway.

Reply on news.ycombinator.com